ISO 27001 A.8.22: Segregation of networks

Design your segmentation architecture based on risk assessment and business needs. Typical trust zones include: external-facing DMZ, internal user network, server network, database network, management network, development and test network, guest and visitor network, IoT/OT network, and cloud virtual networks.

Use a combination of technologies to implement segmentation. VLANs create logical segments within physical infrastructure. Firewalls between segments control inter-segment traffic. Access control lists (ACLs) on network devices add another filtering layer. For virtualised and cloud environments, use micro-segmentation for granular control.

Define traffic flow policies between segments. Apply default-deny and only allow specifically authorised traffic. Document every allowed flow - source, destination, protocol, port, and business justification. Review firewall rules regularly and prune anything unnecessary.

For critical workloads, implement micro-segmentation using host-based firewalls or software-defined networking. This controls traffic at the individual workload level and is especially effective in cloud and virtualised environments. Tools like VMware NSX, cloud-native security groups, and host-based firewalls all support this.

Consider zero-trust principles. Treat all segments as untrusted. Authenticate and authorise every access request regardless of source. Use identity-based controls rather than relying on network location. Implement continuous verification instead of one-time authentication.

Monitor inter-segment traffic for policy violations and anomalies. Verify that actual traffic flows match your defined policies. Alert on unauthorised cross-segment traffic. Review your network architecture periodically to make sure segmentation keeps pace with how your environment evolves.